Lucene search

[email protected]CVE-2019-18856

HistoryNov 11, 2019 - 3:15 p.m.

CVE-2019-18856

2019-11-1115:15:12

CWE-732

[email protected]

web.nvd.nist.gov

cve-2019-18856

denial of service

svg

sanitizer

drupal

nvd

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

43.2%

JSON

A Denial Of Service vulnerability exists in the SVG Sanitizer module through 8.x-1.0-alpha1 for Drupal because access to external resources with an SVG use element is mishandled.

Affected configurations

NVD

Node

drupalsvg_sanitizerRange≤7.x-1.5drupal

drupalsvg_sanitizerMatch8.x-1.0alpha1drupal

CPENameOperatorVersion
drupal:svg_sanitizerdrupal svg sanitizerle7.x-1.5
drupal:svg_sanitizerdrupal svg sanitizereq8.x-1.0

CPE	Name	Operator	Version
drupal:svg_sanitizer	drupal svg sanitizer	le	7.x-1.5
drupal:svg_sanitizer	drupal svg sanitizer	eq	8.x-1.0

References

fortiguard.com/zeroday/FG-VD-19-115

git.drupalcode.org/project/svg_sanitizer/commit/e1b0666

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

43.2%

JSON

Related for CVE-2019-18856

prion1 cvelist1 nvd1